Gregory Todd Williams

After seeing Libby mention my photo privacy code (via Danny) on #swig, I thought I’d better write it up. So I’ve just made public a feature on this website I’ve been playing with for several months. After discussion privacy issues at ISWC with Libby and Bijan, I added support on the photo pages for marking individual photos as private. The idea here is that if you’re in a photo, you have the option of taking it offline.

Here’s what’s going on:

The photos on this site are all annotated using RDF to describe, among other things, the people depicted in the photo. Whenever possible, the RDF describing people includes an Inverse Functional Property, most often the foaf:mbox_sha1sum property based on an email address. This allows the photo annotations to uniquely identify people without exposing their email address.

To make a photo private, you must first log in via TypeKey. TypeKey provides a centralized identity system — the service handles the authentication and returns to my site a username and the either the (verified) email address of the account, or (conveniently) the SHA1 sum of the email address.

Using these two sources of (possibly hashed) email addresses, it’s a simple matter to determine if the user is listed as being depicted in the photo. In the case that the user is depicted in the photo, the site presents them with the option of marking the photo as public or private. This operation generates RDF similar to this:

<rdf:RDF

    xmlns:foaf=”http://xmlns.com/foaf/0.1/”

    xmlns:priv=”http://kasei.us/2005/11/privacy/”

    >

<foaf:Image rdf:about=”/pictures/2005/20050115-Maine_Winterfest/images/DSC_7644.jpg”>

    <priv:hasPolicy>

        <priv:Policy>

            <priv:permission rdf:resource=”http://kasei.us/2005/11/privacy/private”/>

            <foaf:maker rdf:resource=”http://kasei.us/about/foaf.xrdf#greg”/>

        </priv:Policy>

    </priv:hasPolicy>

</foaf:Image>

</rdf:RDF>

The front-end photo gallery code then checks for the presence of any priv:hasPolicy predicates attached to the Image, looking for any marking the image as private.

There are still some issues with the current implementation. For one, the private images aren’t really private yet. They’re just hidden in the photo gallery view, preventing casual browsing. At this point, the image is still visible directly and on the (still-static) people and things pages. I hope to be moving those pages over to dynamic, privacy-respecting code soon.

I’d be interested in formalizing the RDF modeling of this approach to privacy, and seeing it used in more systems than just mine. In particular, I’m interested in more elaborate modeling than just a binary public/private distinction. For example, marking an image as only viewable by members of a foaf:Group.